When I login and logout of a particular website: https://worldcat.authn.worldcat.org/login/manageduser-ui/cmnd/useraction/login?acsURL=https%3A%2F%2Fauthn.sd00.worldcat.org%2Fwayf%2Fmetaauth-ui%2Fcmnd%2Fprotocol%2Facs%2Fsaml2&controllerMethod=samlpost (it's the login page for oclc.org/developer), this is the sequence of HTTP requests:
For login:
I am using Charles Proxy.
I don't see my login information being passed. And I see that at the end of each login/logout, there is a POST request being made with a bunch of rubbish characters in the entity body. For example, this is the POST request from the login:
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: ocspd/1.0
Content-Length: 88
Content-Type: application/ocsp-request
Connection: close
0V0T �0M0K0I0 +�_¦zµ'5ÎC£Ç
a1aÕ/(çF8´,áÆÙâ6
¥Þ$QèÖ~èÏ
I am trying to understand how this technology works. If my login information is not passed in the HTTP requests, or not detected, why, and how else could it have reached the server?